Slovakia and Czech Republic Expand Critical Infrastructure Regulations

Slovakia’s critical‑infrastructure law, which took effect in 2024, now classifies a broader range of entities – including public and rail transport operators, hospitals, large food producers, postal services and industrial firms – as critical. Companies must be notified by 17 July 2026 and complete a nine‑month risk‑assessment and security‑plan process, with compliance costs running into hundreds of thousands of euros and possible fines of up to €300,000 for breaches.

In the Czech Republic, the Ministry of Health announced the publication of implementing regulations for the same law. A government decree on basic services and significance criteria came into force on 18 July 2026, and a decree on resilience planning, risk assessment and incident reporting became effective on 1 August 2026. A dedicated portal will collect required information from qualifying organisations, with a reporting deadline of 1 August 2026. Organisations that previously submitted data must resend it in line with the new rules.